How we handle your data
Last updated: 2026-07-17
- Text prompts & completions are never stored
- Image/video requests & keys cleared on completion (≤7 days)
- Nothing is used to train any model
- TLS-encrypted in transit · encrypted backups
Text requests: content is not stored
For chat, completions and embeddings, we do not persist your prompts or the model's responses.
We keep only usage metadata — the model, token counts, cost, time, source IP and route — used for billing, usage stats and troubleshooting.
Image / video requests: held only while the job runs
Image and video run as asynchronous jobs, which must be persisted briefly so the job can be tracked across polls. Your request (including the prompt) and the API key used to forward it are kept only while the job is actively running.
The moment a job completes or fails, we wipe the request content and the API key, keeping only the result link and status; everything is automatically deleted within 7 days.
Thumbnail previews of generated images are kept at most 3 days for the console log view, then purged.
API keys
We do not retain your API key after a job completes. In the console, keys are stored encrypted and shown only as a masked prefix/suffix.
Never used for training
We never use your prompts, completions or any request content to train our own or any third-party models. This service only forwards your requests.
Upstream model providers
Your request is forwarded to the upstream provider of the model you choose (OpenAI, Anthropic, Google, DeepSeek, etc.), which processes it under its own policy. That part is outside our control.
Encryption & security
All traffic is encrypted in transit (TLS 1.2+) via the Cloudflare edge; account passwords are one-way bcrypt-hashed; off-site backups are encrypted.
Data retention
Text content: not stored. Image/video request & key: cleared on completion, max 7 days. Image thumbnail previews: ≤3 days. Usage-metadata logs: retained short-term for billing and troubleshooting. Billing/invoice records: retained per tax compliance.
Your controls
You can delete your account yourself from the console; we then remove your account and associated data (except records the law requires us to keep). To query or export your usage records, just email us.
Support & incident notice
WanAPI is run by an independent developer; the founder personally replies to support within 24 hours. If a data breach occurs, we notify affected users by email within 72 hours of discovery.
For any data question or request, email [email protected]. For the full terms see our Privacy Policy and Terms.